Threat Brief: OMI Vulnerabilities (CVE-2021-38645, CVE-2021-38647, CVE-2021-38648 and CVE-2021
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-38647 | Unauthenticated RCE in Microsoft Open Management Infrastructure (OMI) CVE-2021-38647 is an unauthenticated remote code execution flaw (CWE-1390, missing authentication) in Microsoft's Open Management Infrastructure (OMI), the open-source Linux management agent Microsoft bundles into Azure VM management extensions and System Center Operations Manager (SCOM) agents. When OMI is deployed through these extensions (for example the Log Analytics/OMS agent, Azure Monitor, or Azure Automation), its root-privileged server component listens for management traffic on the network (by default ports 5985/5986), and an attacker who can reach that port can send specially crafted, unauthenticated management requests that execute commands as root. Successful exploitation gives an attacker full root-level control of the affected Linux VM, turning network reachability into complete host compromise and a foothold for lateral movement. Any Azure Linux VM with an OMI-based management extension, plus standalone OMI or SCOM-agent deployments on Linux, is affected; CISA added the bug to the KEV on 2021-11-03 with known ransomware use, so exploitation is confirmed in the wild even though no public proof-of-concept is catalogued, and EPSS estimates a ~99.9% near-term exploitation probability. Do: Upgrade OMI to version 1.6.8-1 or later on all Linux VMs, including updating the bundled OMI inside Azure management extensions (Log Analytics/OMS agent, Azure Monitor, Azure Automation) and applying patched SCOM agent builds. Restrict network access to OMI's listener ports (5985/5986) with NSGs or host firewalls and check whether omiserver runs as root while binding beyond localhost. Because the flaw is in CISA KEV with known ransomware use, prioritize patching hosts whose OMI listener is reachable from untrusted networks and hunt for unexplained root-level activity. | 9.8 group max | 100% | KEV ransomware PoC |
| mass≈ millions of Linux VMs with OMI-based Azure management extensions |
Full article487 words · extracted from unit42.paloaltonetworks.com · click to collapse
Executive Summary
On Sept. 14, 2021, Microsoft’s Security Response Center (MSRC) released security patches detailing the findings of four critical vulnerabilities affecting the Microsoft Azure package Open Management Infrastructure (OMI). The open-source OMI package is designed to provide a portable infrastructure backbone for web-based management tools, such as diagnostic monitoring, log analytic services and automation functionality within UNIX and Linux systems. OMI is used by Microsoft Azure to manage UNIX packages within Azure virtual machines (VMs), containers and serverless cloud instances. According to Microsoft’s security release notes, any system created, or which has updated its OMI package, after Aug. 11, 2021, should automatically be patched.
Four Critical OMI Vulnerabilities
The four critical vulnerabilities discovered by security researchers from Wiz include one unauthenticated remote code execution (RCE) and three privilege escalation vulnerabilities.
- CVE-2021-38645 – Privilege Escalation vulnerability
- CVE-2021-38647 – Unauthenticated RCE as root
- CVE-2021-38648 – Privilege Escalation vulnerability
- CVE-2021-38649 – Privilege Escalation vulnerability
Dubbed OMIGOD, the four vulnerabilities were found to directly affect Azure cloud instances using the following Azure services:
- Azure Automation
- Azure Automatic Update
- Azure Operations Management Suite
- Azure Log Analytics
- Azure Configuration Management
- Azure Diagnostics
Prisma Cloud Compute Defender agents can detect whether any Azure system is vulnerable to any of the four CVEs. Additionally, Prisma Cloud users can also build a custom vulnerability detection rule to identify if any system is running an OMI package with a version previous to 1.6.8.1.
To build a custom vulnerability detection rule, open Prisma Cloud and navigate to the following page:
- Compute > Manage > System > Custom Feeds > Custom Vulnerabilities > Import CSV
- Create a csv file and populate that file with the following text:
name,type,package,minVersionInclusive,maxVersionInclusive,md5
OMIGOD,package,omi,*,1.6.8.0,
Palo Alto Networks Azure-based VM- and CN-Series Firewall instances do not use the OMI package and are not vulnerable to the OMI critical vulnerabilities.
Remediation
Prisma Cloud will create an alert for any system which maintains an OMI package vulnerable to the OMI critical vulnerabilities. Should a system be identified as vulnerable, the following steps should be taken for that Azure Cloud Instance:
- Log on to the Azure instance using SSH.
- Execute the following command:
- Debian – sudo apt list omi
- CentOS – sudo yum list omi
- Determine if OMI version is < 1.6.8.1.
- If the system maintains an older version of OMI, perform the steps listed within the OMI GitHub Page.
Conclusion
On Sept. 14, 2021, security researchers from Wiz released a report detailing the findings of four critical vulnerabilities affecting the Microsoft Azure package OMI. Dubbed OMIGOD, the four vulnerabilities were found to directly affect Azure Cloud Instances. Palo Alto Networks Azure-based VM and CN Series Firewall instances do not use the OMI package and are not vulnerable to the OMI critical vulnerabilities. Customers of Prisma Cloud have the ability to create alerts to detect vulnerabilities.
Additional Resources
Text extracted automatically; images, tables and formatting may be missing. Original: https://unit42.paloaltonetworks.com/omi-vulnerabilities/